SSL support for TCP Sockets

[Aedda]

SSL support would allow programs like IRC to safely enter user/pass combos for instance or securely sync data between a website and in-game with less worry of data being intercepted.

Someone on IRC said this topic may have come up in the past and was deemed undoable due to needing to be written in Lua. However I found these earlier and was wondering if adding support for it could/would be possible...

http://notebook.kulchenko.com/programming/https-ssl-calls-with-lua-and-luasec

https://www.broadinstitute.org/~carneiro/software/luassl/intro.html

https://github.com/zhaozg/lua-openssl

and

http://lua-users.org/wiki/CryptographyStuff

[Xe]

Where possible I would highly suggest the use of luasec simply due to the fact that it is a simple wrapper around the system SSL library. It does require a system SSL library to be present however and may not work as well on less than capable operating systems (cough windows cough). It needs more research.

[Kubuxu]

HTTP is handled by Java/scala. It is not Lua's lib. Handling SSL should be done Java's part.

[fnuecke]

The thing with those is that they're native libraries - meaning they'd have to be built into the native lib, which would set a precedent I'd rather not. A potentially feasible solution might be providing SSL sockets via userdata wrapped Java SSL sockets. Haven't messed with those in a while though, remember them being kind of annoying to deal with however (keystore stuff?)

If someone were to make a proof-of-concept addon card that provides SSL sockets or make a PR, there's a good chance I'd merge it. Can't promise I'll look into this soon myself.

[twothe]

Lua 5.3 will have native bit manipulation support. Once that is reasonably stable, pur LUA SSH libs will follow soon for sure.

[Kubuxu]

I don''t think someone will create pure TLS in pure lua. Look at the size of OpenSSL codebase. It is just too much for hobby project (most projects for lua are such).

[RyanSquared]

Can we not do this in Java/Scala? The networking code is already done that way.

I plan on taking a look at this later if I can to see what I can do with it.

[fnuecke]

Yeah, that'd be the most practical and consistent approach. I'm not sure off the top of my head what kind of configuration the SSL sockets need, but if the answer to that is none/minimal, it might just be a boolean/set of parameter(s) added to the existing connect method.

[twothe]

Doing the connection would be a simple SSLSocket instead of Socket, however when the server asks for client authentication things might get difficult. OpenComputers would need to have a valid certificate or offer an option to inject one.

My first question when confronted with this would by "Why?". OP says to ensure security in communications, which sounds a bit off considering that it in the end runs in a completely unsecured environment. Give me a moment and I add a mod to my server that will log all communication you do unencrypted and grabs all passwords you enter and sends them home.

[Kubuxu]

There are two types of safe communication:

• Making sure that client and server are who they supposed to be.
• Full encryption.

The first is trivial even in Lua. Just look at Challenge–response_authentication
Second is a bit more complicated but if AES would get into OC it would also possible and simple.

[twothe]

On the first: yes, there are enough solutions out there that everyone can implement, and most official servers (like IRC) use them anyways.

On the second: The problem I see here is the illusion that SSL actually adds any security to OC. Keep in mind that all data you enter on your keyboard is actually sent completely unencrypted to the server, so if I want to know your password, that would be the easiest point to intercept it. Furthermore if I would be an evil server owner, I could add a mod that logs everything fully automatic. No amount of encryption added to OC could change that, because the environment it runs in is unsecured.

Now while I won't mind SSL as a feature, I see the danger that some people then actually transmit sensitive data and are later surprised if it was still stolen, despite an encrypted TCP connection.

[gjgfuj]

Some sites require encrypted connections anyway. And who cares?